Active: WordPress 7.1.3

WordPress security warnings

Urgent core and campaign notes. Update first, then verify.

WordPress 7.1.3 · Published Oct 6, 2026

Maintenance and Security Release: 7 security fixes and 4 bug fixes. Led by Jake Spurlock.

This is a security release. Update every site you manage. Official wordpress.org posts are the authority; we summarize so you can act.

Same-day builds on the releases archive: 7.1.3, 7.0.7, 6.9.10, 6.8.11, 6.7.10, 6.6.10. WordPress says security fixes are being backported where necessary through 4.7; older than 6.6 may still be in progress. Do not assume every older branch is already patched until it appears on the releases page.

Do now

Update to WordPress 7.1.3 (or your branch security build if listed on the releases archive).
Confirm the version under Dashboard → Updates. Do not stop at “you have the latest.”
Prefer staying on current 7.1.x. Older branches get courtesy security backports only.

Security fixes

Stored XSS on the Comments administration page (via pending comments)
DoS in WP_Http::make_absolute_url()
Second-order SQL injection in WordPress WXR export
Author-role users able to sticky posts (capability weakness)
Unauthenticated disclosure of comments on private and unpublished posts
Imgur embeds vulnerable to XSS
Forgeable parameters to {status}_{type} hook (action name collision risk)

Official WordPress 7.1.3 news post

Update and protect Malware scanner

Past warnings

Keep WordPress updated

Confirm the version on every site. Then use scans and hardening if you want a clearer picture of leftover risk.

Update and protect Malware scanner